JLSEC-2026-18 — Vulnetix

JLSEC-2026-18 PUBLISHED CVSS 9.300000190734863 CRITICAL

GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952.

Risk Scores

CVSS v4.0

9.300000190734863

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Products

Vendor	Product	Versions
Julia	patch_jll	0, 0

Timeline

Mar 31, 2026 CVE Published
Mar 31, 2026 CVE Updated

References

https://savannah.gnu.org/bugs/index.php?56683 url

Open in Interactive Console →